Keeper BreachWatch Credential Compromise Event
This rule identifies events from Keeper BreachWatch indicating potential credential compromise. It specifically looks for logs categorized as 'breachwatch' and extracts details about the breach, including compromised domains and risk severity, along with the affected username and remote IP address.
Microsoft Sentinel (KQL)
